nat: fixed input validation

[vpp.git] / src / plugins / nat / out2in.c

diff --git a/src/plugins/nat/out2in.c b/src/plugins/nat/out2in.c
old mode 100755 (executable)
new mode 100644 (file)
index 411f193..44f7dcf
--- a/src/plugins/nat/out2in.c
+++ b/src/plugins/nat/out2in.c
@@ -278,25 +278,25 @@ static_always_inline
   if (!icmp_type_is_error_message
       (vnet_buffer (b)->ip.reass.icmp_type_or_tcp_flags))
     {
-      key0.protocol = SNAT_PROTOCOL_ICMP;
+      key0.protocol = NAT_PROTOCOL_ICMP;
       key0.addr = ip0->dst_address;
-      key0.port = vnet_buffer (b)->ip.reass.l4_src_port;       // TODO should this be dst port?
+      key0.port = vnet_buffer (b)->ip.reass.l4_src_port;
     }
   else
     {
       inner_ip0 = (ip4_header_t *) (echo0 + 1);
       l4_header = ip4_next_header (inner_ip0);
-      key0.protocol = ip_proto_to_snat_proto (inner_ip0->protocol);
+      key0.protocol = ip_proto_to_nat_proto (inner_ip0->protocol);
       key0.addr = inner_ip0->src_address;
       switch (key0.protocol)
        {
-       case SNAT_PROTOCOL_ICMP:
+       case NAT_PROTOCOL_ICMP:
          inner_icmp0 = (icmp46_header_t *) l4_header;
          inner_echo0 = (icmp_echo_header_t *) (inner_icmp0 + 1);
          key0.port = inner_echo0->identifier;
          break;
-       case SNAT_PROTOCOL_UDP:
-       case SNAT_PROTOCOL_TCP:
+       case NAT_PROTOCOL_UDP:
+       case NAT_PROTOCOL_TCP:
          key0.port = ((tcp_udp_header_t *) l4_header)->src_port;
          break;
        default:
@@ -341,6 +341,7 @@ icmp_match_out2in_slow (snat_main_t * sm, vlib_node_runtime_t * node,
   u32 next0 = ~0;
   int err;
   u8 identity_nat;
+  vlib_main_t *vm = vlib_get_main ();
 
   sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
   rx_fib_index0 = ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
@@ -404,7 +405,7 @@ icmp_match_out2in_slow (snat_main_t * sm, vlib_node_runtime_t * node,
       /* Create session initiated by host from external network */
       s0 = create_session_for_static_mapping (sm, b0, sm0, key0,
                                              node, thread_index,
-                                             vlib_time_now (tsm->vlib_main));
+                                             vlib_time_now (vm));
 
       if (!s0)
        {
@@ -530,7 +531,6 @@ icmp_out2in (snat_main_t * sm,
             vlib_node_runtime_t * node,
             u32 next0, u32 thread_index, void *d, void *e)
 {
-  snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
   snat_session_key_t sm0;
   u8 protocol;
   icmp_echo_header_t *echo0, *inner_echo0 = 0;
@@ -543,6 +543,7 @@ icmp_out2in (snat_main_t * sm,
   ip_csum_t sum0;
   u16 checksum0;
   u32 next0_tmp;
+  vlib_main_t *vm = vlib_get_main ();
 
   echo0 = (icmp_echo_header_t *) (icmp0 + 1);
 
@@ -557,7 +558,7 @@ icmp_out2in (snat_main_t * sm,
   if (PREDICT_TRUE (!ip4_is_fragment (ip0)))
     {
       sum0 =
-       ip_incremental_checksum_buffer (tsm->vlib_main, b0,
+       ip_incremental_checksum_buffer (vm, b0,
                                        (u8 *) icmp0 -
                                        (u8 *) vlib_buffer_get_current (b0),
                                        ntohs (ip0->length) -
@@ -623,7 +624,7 @@ icmp_out2in (snat_main_t * sm,
 
          switch (protocol)
            {
-           case SNAT_PROTOCOL_ICMP:
+           case NAT_PROTOCOL_ICMP:
              inner_icmp0 = (icmp46_header_t *) l4_header;
              inner_echo0 = (icmp_echo_header_t *) (inner_icmp0 + 1);
 
@@ -637,8 +638,8 @@ icmp_out2in (snat_main_t * sm,
                                identifier);
              icmp0->checksum = ip_csum_fold (sum0);
              break;
-           case SNAT_PROTOCOL_UDP:
-           case SNAT_PROTOCOL_TCP:
+           case NAT_PROTOCOL_UDP:
+           case NAT_PROTOCOL_TCP:
              old_id0 = ((tcp_udp_header_t *) l4_header)->src_port;
              new_id0 = sm0.port;
              ((tcp_udp_header_t *) l4_header)->src_port = new_id0;
@@ -670,7 +671,8 @@ icmp_out2in_slow_path (snat_main_t * sm,
                       u32 next0, f64 now,
                       u32 thread_index, snat_session_t ** p_s0)
 {
-  snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
+  vlib_main_t *vm = vlib_get_main ();
+
   next0 = icmp_out2in (sm, b0, ip0, icmp0, sw_if_index0, rx_fib_index0, node,
                       next0, thread_index, p_s0, 0);
   snat_session_t *s0 = *p_s0;
@@ -679,7 +681,7 @@ icmp_out2in_slow_path (snat_main_t * sm,
       /* Accounting */
       nat44_session_update_counters (s0, now,
                                     vlib_buffer_length_in_chain
-                                    (tsm->vlib_main, b0), thread_index);
+                                    (vm, b0), thread_index);
       /* Per-user LRU list maintenance */
       nat44_session_update_lru (sm, s0, thread_index);
     }
@@ -811,9 +813,9 @@ VLIB_NODE_FN (snat_out2in_node) (vlib_main_t * vm,
              goto trace0;
            }
 
-         proto0 = ip_proto_to_snat_proto (ip0->protocol);
+         proto0 = ip_proto_to_nat_proto (ip0->protocol);
 
-         if (PREDICT_FALSE (proto0 == ~0))
+         if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_OTHER))
            {
              if (nat_out2in_sm_unknown_proto (sm, b0, ip0, rx_fib_index0))
                {
@@ -828,7 +830,7 @@ VLIB_NODE_FN (snat_out2in_node) (vlib_main_t * vm,
              goto trace0;
            }
 
-         if (PREDICT_FALSE (proto0 == SNAT_PROTOCOL_ICMP))
+         if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_ICMP))
            {
              next0 = icmp_out2in_slow_path
                (sm, b0, ip0, icmp0, sw_if_index0, rx_fib_index0, node,
@@ -857,7 +859,7 @@ VLIB_NODE_FN (snat_out2in_node) (vlib_main_t * vm,
                   * be able to use dhcp client on the outside interface
                   */
                  if (PREDICT_FALSE
-                     (proto0 == SNAT_PROTOCOL_UDP
+                     (proto0 == NAT_PROTOCOL_UDP
                       && (vnet_buffer (b0)->ip.reass.l4_dst_port ==
                           clib_host_to_net_u16
                           (UDP_DST_PORT_dhcp_to_client))))
@@ -901,7 +903,7 @@ VLIB_NODE_FN (snat_out2in_node) (vlib_main_t * vm,
                                 dst_address /* changed member */ );
          ip0->checksum = ip_csum_fold (sum0);
 
-         if (PREDICT_TRUE (proto0 == SNAT_PROTOCOL_TCP))
+         if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP))
            {
              if (!vnet_buffer (b0)->ip.reass.is_non_first_fragment)
                {
@@ -983,9 +985,9 @@ VLIB_NODE_FN (snat_out2in_node) (vlib_main_t * vm,
              goto trace1;
            }
 
-         proto1 = ip_proto_to_snat_proto (ip1->protocol);
+         proto1 = ip_proto_to_nat_proto (ip1->protocol);
 
-         if (PREDICT_FALSE (proto1 == ~0))
+         if (PREDICT_FALSE (proto1 == NAT_PROTOCOL_OTHER))
            {
              if (nat_out2in_sm_unknown_proto (sm, b1, ip1, rx_fib_index1))
                {
@@ -1000,7 +1002,7 @@ VLIB_NODE_FN (snat_out2in_node) (vlib_main_t * vm,
              goto trace1;
            }
 
-         if (PREDICT_FALSE (proto1 == SNAT_PROTOCOL_ICMP))
+         if (PREDICT_FALSE (proto1 == NAT_PROTOCOL_ICMP))
            {
              next1 = icmp_out2in_slow_path
                (sm, b1, ip1, icmp1, sw_if_index1, rx_fib_index1, node,
@@ -1029,7 +1031,7 @@ VLIB_NODE_FN (snat_out2in_node) (vlib_main_t * vm,
                   * be able to use dhcp client on the outside interface
                   */
                  if (PREDICT_FALSE
-                     (proto1 == SNAT_PROTOCOL_UDP
+                     (proto1 == NAT_PROTOCOL_UDP
                       && (vnet_buffer (b1)->ip.reass.l4_dst_port ==
                           clib_host_to_net_u16
                           (UDP_DST_PORT_dhcp_to_client))))
@@ -1075,7 +1077,7 @@ VLIB_NODE_FN (snat_out2in_node) (vlib_main_t * vm,
                                 dst_address /* changed member */ );
          ip1->checksum = ip_csum_fold (sum1);
 
-         if (PREDICT_TRUE (proto1 == SNAT_PROTOCOL_TCP))
+         if (PREDICT_TRUE (proto1 == NAT_PROTOCOL_TCP))
            {
              if (!vnet_buffer (b1)->ip.reass.is_non_first_fragment)
                {
@@ -1188,9 +1190,9 @@ VLIB_NODE_FN (snat_out2in_node) (vlib_main_t * vm,
          rx_fib_index0 = vec_elt (sm->ip4_main->fib_index_by_sw_if_index,
                                   sw_if_index0);
 
-         proto0 = ip_proto_to_snat_proto (ip0->protocol);
+         proto0 = ip_proto_to_nat_proto (ip0->protocol);
 
-         if (PREDICT_FALSE (proto0 == ~0))
+         if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_OTHER))
            {
              if (nat_out2in_sm_unknown_proto (sm, b0, ip0, rx_fib_index0))
                {
@@ -1215,7 +1217,7 @@ VLIB_NODE_FN (snat_out2in_node) (vlib_main_t * vm,
              goto trace00;
            }
 
-         if (PREDICT_FALSE (proto0 == SNAT_PROTOCOL_ICMP))
+         if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_ICMP))
            {
              next0 = icmp_out2in_slow_path
                (sm, b0, ip0, icmp0, sw_if_index0, rx_fib_index0, node,
@@ -1244,7 +1246,7 @@ VLIB_NODE_FN (snat_out2in_node) (vlib_main_t * vm,
                   * be able to use dhcp client on the outside interface
                   */
                  if (PREDICT_FALSE
-                     (proto0 == SNAT_PROTOCOL_UDP
+                     (proto0 == NAT_PROTOCOL_UDP
                       && (vnet_buffer (b0)->ip.reass.l4_dst_port ==
                           clib_host_to_net_u16
                           (UDP_DST_PORT_dhcp_to_client))))
@@ -1290,7 +1292,7 @@ VLIB_NODE_FN (snat_out2in_node) (vlib_main_t * vm,
                                 dst_address /* changed member */ );
          ip0->checksum = ip_csum_fold (sum0);
 
-         if (PREDICT_TRUE (proto0 == SNAT_PROTOCOL_TCP))
+         if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP))
            {
              if (!vnet_buffer (b0)->ip.reass.is_non_first_fragment)
                {
@@ -1470,12 +1472,12 @@ VLIB_NODE_FN (snat_out2in_fast_node) (vlib_main_t * vm,
              goto trace00;
            }
 
-         proto0 = ip_proto_to_snat_proto (ip0->protocol);
+         proto0 = ip_proto_to_nat_proto (ip0->protocol);
 
-         if (PREDICT_FALSE (proto0 == ~0))
+         if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_OTHER))
            goto trace00;
 
-         if (PREDICT_FALSE (proto0 == SNAT_PROTOCOL_ICMP))
+         if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_ICMP))
            {
              next0 = icmp_out2in (sm, b0, ip0, icmp0, sw_if_index0,
                                   rx_fib_index0, node, next0, ~0, 0, 0);
@@ -1509,7 +1511,7 @@ VLIB_NODE_FN (snat_out2in_fast_node) (vlib_main_t * vm,
              old_port0 = udp0->dst_port;
              udp0->dst_port = new_port0;
 
-             if (PREDICT_TRUE (proto0 == SNAT_PROTOCOL_TCP))
+             if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP))
                {
                  sum0 = tcp0->checksum;
                  sum0 = ip_csum_update (sum0, old_addr0, new_addr0,
@@ -1534,7 +1536,7 @@ VLIB_NODE_FN (snat_out2in_fast_node) (vlib_main_t * vm,
            }
          else
            {
-             if (PREDICT_TRUE (proto0 == SNAT_PROTOCOL_TCP))
+             if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP))
                {
                  sum0 = tcp0->checksum;
                  sum0 = ip_csum_update (sum0, old_addr0, new_addr0,